trachev - Debt rates will be wrongly set when debt is repaid

[sherlock-admin3]

trachev

Medium

Debt rates will be wrongly set when debt is repaid

Summary

In executeRepay interest rates are updated before the debt is repaid, causing the new debt rates to be calculated wrongly as vars.totalDebt will be set to a value prior to the repayment.

Root Cause

• In executeRepay the interest rates are calculated before the debt is actually repaid and the previous value of totalSupplies.debtShares, prior to the repayment, is used when getting vars.totalDebt. vars.totalDebt is used when calculating what the debt rate should be when calling calculateInterestRates. Thus, as the total debt includes the debt that is removed/repaid, vars.totalDebt will be higher, causing the borrow rate to be higher than expected.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

• The borrow rate will be higher than expected after debt is repaid. This causes a loss of funds for borrowers and potential unexpected liquidations as borrowers will have to account for the higher borrow rate.

PoC

No response

Mitigation

The borrow rate should be updated after the debt is repaid, just as it is currently done in executeBorrow. In executeBorrow when updateInterestRates is called the new value of _cache.nextDebtShares is used.

Duplicate of #413